1.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-1337

CVE-2026-1337: Insufficient escaping of unicode characters in query log

Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01.

Proof of concept exploit: https://github.com/JoakimBulow/CVE-2026-1337

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-1337

CVE-2026-1337:

1.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.neo4j:neo4j	maven	< 2026.01	2026.01

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the insufficient escaping of unicode characters in Neo4j's query log. The provided proof-of-concept demonstrates that it's possible to inject fake log entries by including newline characters (\n) in the metadata of a Bolt transaction. This indicates a failure in sanitizing user-provided input before it's written to the log files.

Analysis of the commits between the vulnerable and patched versions revealed a key change in the org.neo4j.util.Stringifier.escaped method within the file community/common/src/main/java/org/neo4j/util/Stringifier.java. The commit 0544847374f9d7754ee7f2e1f6702e3df1df61de specifically addresses the escaping of unicode characters.

The original implementation of the escaped method only handled the escaping of backticks. The patch introduces a regular expression to also escape unicode sequences. This directly addresses the described vulnerability. When a query is logged, its parameters (including transaction metadata) are stringified. The escaped function is a crucial part of this process. Its failure to properly sanitize unicode characters allowed for the injection of control characters, leading to the reported log injection vulnerability.

Therefore, the org.neo4j.util.Stringifier.escaped function is identified as the vulnerable function. During exploitation, a call to this function with a malicious payload (containing unescaped unicode control characters) would be a primary indicator in a runtime profile or stack trace.

Vulnerable functions

org.neo4j.util.Stringifier.escaped

community/common/src/main/java/org/neo4j/util/Stringifier.java

The `escaped` method in `org.neo4j.util.Stringifier` was responsible for escaping strings before they are logged. The original implementation only replaced backticks (` ` `) with double backticks (`` ``) and did not handle unicode characters or other control characters. This allowed an attacker to inject malicious strings, including newlines and other control characters, into the query log by sending them in the metadata of a bolt transaction. This could lead to log spoofing or Cross-Site Scripting (XSS) if the logs are viewed in a tool that interprets HTML.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.